Not at all -- the point (in general) of MUST is that as a service owner, you can assume that your implementation won't work properly unless you adhere to the sp

Not at all -- the point (in general) of MUST is that as a service owner, you can assume that your implementation won't work properly unless you adhere to the specification. But unless you control all of the implementations you're interacting with, you can't assume that they'll conform. You might well decide to handle non-compliance by declining to continue, but you still need to handle those cases. I don't disagree with your assessment of the changes required to Prometheus or the vulnerability scanner, but I'd rate the Prometheus bug as really low priority, and the feature request for the scanner as a blocker for adoption: it might be correctly behaving as designed, but that doesn't mean the design is useful.